Cyber Resilience

CVE-2024-10443

CriticalRCE

Published: 15 November 2024

Published
15 November 2024
Modified
16 September 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.7564 98.9th percentile
Risk Priority 65 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-10443 is a critical-severity OS Command Injection (CWE-78) vulnerability in Synology Photos. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 1.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2024-10443 is an OS command injection vulnerability (CWE-78, CWE-77) residing in the Task Manager component of Synology BeePhotos (versions before 1.0.2-10026 and 1.1.0-10053) and Synology Photos (versions before 1.6.2-0720 and 1.7.0-0795). The flaw stems from improper neutralization of special elements in OS commands and carries a CVSS 3.1 base score of 9.8, reflecting network-accessible attack vectors with no required privileges or user interaction.

Unauthenticated remote attackers can supply crafted input to trigger arbitrary command execution on the affected host. Successful exploitation grants full control over confidentiality, integrity, and availability, enabling outcomes such as malware deployment, data exfiltration, or lateral movement within the environment.

Synology security advisories SA 24-18 and SA 24-19 recommend immediate upgrade to the corrected releases (BeePhotos 1.0.2-10026 / 1.1.0-10053 and Photos 1.6.2-0720 / 1.7.0-0795) as the primary mitigation; no workarounds are specified. The associated EPSS score of 0.7564 indicates substantial exploitation likelihood but has remained flat since disclosure.

EU & UK References

Vulnerability details

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synology BeePhotos before 1.0.2-10026 and 1.1.0-10053 and Synology Photos before 1.6.2-0720 and 1.7.0-0795 allows remote attackers to execute arbitrary code via…

more

unspecified vectors.

CWE(s)
CWE-78CWE-77

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

synology
photos
≤ 1.6.2-0720 · ≤ 1.7.0-0795
synology
beephotos
≤ 1.1.0-10053 · ≤ 1.0.2-10026

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References